Hi,
I have the following problem when using the "limit_execution" feature together with the option "limit_execution_coverage" in rules of type flatline. We use the limit_execution feature in order to not trigger an alert for a limited time frame in the night where the query in the rule will find any hits. Just because the job that is queried is paused for that time frame. Of course want to prevent any alerting in this time frame.
If we configure the rule accordingly using limit_execution and limit_execution_coverage, everything is fine for the paused time interval but the next execution after the pause does neither respect the buffer_time settings not the timeframe configuration. The rule is queried from 01:00:00 to 01:00:xy so for a too short time window.
I had a look in the code and in my opinion the reason for the too small query time window is, that the rule property "minimum_starttime" and "previous_endtime" are set to the same value as "next_starttime" (method reset_rule_schedule in elastalert.py)
Yet, maybe I missed something. I'd appreciate any comment.
Hi, I have the following problem when using the "limit_execution" feature together with the option "limit_execution_coverage" in rules of type flatline. We use the limit_execution feature in order to not trigger an alert for a limited time frame in the night where the query in the rule will find any hits. Just because the job that is queried is paused for that time frame. Of course want to prevent any alerting in this time frame. If we configure the rule accordingly using limit_execution and limit_execution_coverage, everything is fine for the paused time interval but the next execution after the pause does neither respect the buffer_time settings not the timeframe configuration. The rule is queried from 01:00:00 to 01:00:xy so for a too short time window. I had a look in the code and in my opinion the reason for the too small query time window is, that the rule property "minimum_starttime" and "previous_endtime" are set to the same value as "next_starttime" (method reset_rule_schedule in elastalert.py) Yet, maybe I missed something. I'd appreciate any comment.